letsencrypt / boulder

An ACME-based certificate authority, written in Go.
Mozilla Public License 2.0
5.16k stars 605 forks source link

Perform remote validation after primary validation #7522

Closed aarongable closed 3 months ago

aarongable commented 4 months ago

Change the VA to perform remote validation wholly after local validation and CAA checks, and to do so only if those local checks pass. This will likely increase the latency of our successful validations, by making them less parallel. However, it will reduce the amount of work we do on unsuccessful validations, and reduce their latency, by not kicking off and waiting for remote results.

Note to reviewers: I suggest reviewing this PR one commit at a time: each commit is small and self-contained, only editing one function.

Fixes https://github.com/letsencrypt/boulder/issues/7509